Partner Privacy Policy

1. INTRODUCTION

Welcome to Super App Ltd’s privacy notice (the “Notice”).

Super App Ltd (C 101360) of 125, Triq Anici, Qormi, Malta (“Script”, “we”; “us”; “our”) respects your privacy and is committed to protecting your personal data.

We have launched a digital application which enables medical professionals (whom we term our “Partners”) to: (i) create, issue and receive renewal requests for prescriptions, and in which cases the end-user’s payment for the prescription would also be effected over the app and received by SCRIPT and ultimately released by it, net of the commission due, to the relevant partner, and additionally (ii) to schedule and book appointments with end-users (including to respond to requests for appointments) (collectively, the “Services”).

This app is named “Script” (the “App”) and is operated by us (Super Apps Ltd) in order to make accessible and provide those Services to our registered End-Users and Partners.

The purpose of this Notice is to set out the basis on which we will process your personal data when you:

  • visit and use our App as a medical professional (regardless of where you visit or use it from);
  • apply for and open an account with us as a Partner (your “Partner Account”); and
  • apply for, receive or use any of the Services that we offer to our Partners through the App.

This includes any data that you may provide for and in relation to our newsletters, updates, events and other marketing and promotional communications.

This Notice explains what personal data we collect about our Partners, how and why we collect that data and the ways in which we may disclose it and our reasons for doing so. It also provides information on how to exercise your rights as a data subject in relation to your personal data (see Section 11 – “your legal rights”).

This Notice should be read in conjunction with our Partner Terms and Conditions. We may revise this Notice from time to time, but we will never do so in a manner that undermines your rights. We will provide notice through the App when we make any material modifications to this Notice and strongly encourage you to review any changes made. We also have a separate privacy notice and applicable terms and conditions for our registered End-Users.

2. INFORMATION ABOUT SCRIPT

Through the App, SCRIPT provides a digital platform that connects End-Users and Partners. SCRIPT’s technology permits Partners to make use of the Services available to them via the App, which includes the ability to receive requests from End-Users, issue e-prescriptions and schedule medical appointments. The terms and conditions on which SCRIPT makes available and provides these Services to Partners can be accessed here.

These Services are only made available to registered Partners. They must meet eligibility requirements, including being registered with the Malta Medical Council and suitably licensed to practice as a medical practitioner or (as applicable to the Partner) dental surgeon in Malta.

Controller

SCRIPT is the operator of the App and is also the controller and responsible for your personal data in accordance with the General Data Protection Regulation (“GDPR”) and Maltese data protection laws.

If you have any questions or requests, including any requests to exercise your legal rights as a data subject, please contact us using the details set out below:

Contact Details

Full name of legal entity:            Super App Ltd (C 101360)

Email address:                          info@script.mt

Postal address:                         125, Triq Anici, Qormi, Malta

Third-Party Links

The App may include links to third-party websites, plug-ins and applications, whose practices may differ from our own. Clicking on those links or otherwise enabling those connections may allow such third parties to collect or share personal data about you. We do not control these third-party websites or applications and we are not in any way responsible for their privacy notices, statements or practices. We encourage you to carefully read the privacy notice, privacy statement and other policy of any website or application you visit, access or use.

Your Duty to Inform Us of Changes

It is imperative that the personal data we hold about you is accurate and current at all times. Otherwise, this will prevent us from being able to properly administer your Partner Account or provide you with the Services (amongst other potential issues). Please keep us informed if your personal data changes during your relationship with us.

3. SOME KEY DEFINITIONS

Set out below are key definitions of certain data protection terms which appear in and apply to this Notice:

  • data subjects” means living, natural persons about whom we process personal data;
  • data controller” or “controller” means any entity or individual who determines the purposes for which, and the manner in which, any personal data is processed;
  • data processor” or “processor” means any entity or individual that processes data on our behalf and on our instructions (we being the data controller);
  • GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679);
  • legitimate interest” means our interest to conduct and manage our business appropriately and responsibly, to protect the reputation of our business, and to provide the best possible services. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests;
  • personal data” means data relating to a living individual (i.e., natural person) who can be identified from the data we possess about him or her. This includes, but is not limited to, your name and surname, address, date of birth, contact details. It does not include information relating to a legal person (such as a company);
  • processing” means any activity or set of operations that involves use of personal data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including, organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties; and
  • sensitive personal data” includes information about a person’s racial or ethnic origin, political opinions, religious, philosophical or similar beliefs, trade union membership, physical or mental health or condition or sexual life or his or her biometric data.

4. THE PERSONAL DATA WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). In the course of your relationship with us (including during the account opening stage), we may collect, use, store and transfer different kinds of personal data which we have grouped together.

  • Identity Data: includes your first name, surname, title, gender, address, and account details (including your username). This will form part of your Partner Account information on the App;
  • Contact Data: includes your billing address, email address and contact details;
  • Professional Data: includes details about your specialisation, title and position (e.g. consultant), the clinics which you attend and proof of your qualifications and certifications (as may be requested by us);
  • Financial Data: includes your bank account number and details (including IBAN);
  • Service Data: includes Contact Data and details about:
    • your use of the Services, including e-prescriptions issued and appointments scheduled;
    • payment history with us and the invoices which have been issued to you by us;
  • Technical Data: includes the IP address, your login data to the App (username and password), device type, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and other technology on the devices you use to access the App;
  • Usage Data: includes information about how you use the App and the Services as a Partner; and
  • Marketing Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share data in an aggregated form such as statistical or demographic data to improve the App and for statistical and benchmarking purposes, including enabling comparisons within the same industry to enhance the insights collected through the App.  Aggregated Data could be derived from your personal data but will not be considered personal data in law as it will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

If you Fail to provide Personal Data

Where we need to collect personal data about you:

  • by law; or
  • under the terms of, or in connection with, the contract that we have with you (as discussed above); or
  • as part of our legitimate (business) interests to verify and vet our Partners, mitigate against risks (such as potential or suspected fraud) and in particular, to assess and take a decision on whether we will or should enter into a relationship with you (as subject to our eligibility requirements);

and you either fail to provide that data when requested, or else provide incomplete or insufficient data, we may not be able to perform or conclude the contract that we have or are trying to enter into with you. This may include having to refuse your registration as a Partner or closure of your Partner Account.

Sensitive Personal Data

A key aspect of the Services involves the issuance of e-prescriptions, which we process through the App and also store and keep available for you in order to be able to use and consult as part of your patient records.

This however refers to sensitive data relating to the health status or condition of the end-user, and, in principle, we do not knowingly collect sensitive personal data directly about Partners.

Should we receive sensitive personal data about you, we will only process that data where there is a legitimate reason to do so and, in all circumstances, in accordance with our obligations at law and under appropriate safeguards.

5. HOW IS YOUR PERSONAL DATA COLLECTED?

(A)       Account Registration and Opening.

We will ask you to provide us with your Identity, Contact, Professional and Financial Data when you apply to register and open an account with us as a Partner on the App. You provide these personal details to us, which we subsequently collect and process, when you fill in and submit our online form (together with other related forms) and complete other required steps for your Partner Account.

Your account information and Service Data will then be generated based on your registration and use of the App and its services. We will also process this information in the course of your relationship with us.

(B)       Service Use

This may encompass all of the data categories listed in section 4, particularly Identity, Usage and Service Data.

(C)       Direct Interactions.

You may also give us your Identity, Contact, Professional, Financial and Service Data by filling in our other forms (i.e., separate to our account opening and registration form), or by corresponding with us by post, phone, e-mail or otherwise. This includes personal data that you provide when you, as applicable: 

  • apply to create and register a Partner Account;
  • request or receive our Services;
  • update or edit your account details;
  • contact us with complaints or queries;
  • report issues;
  • submit the (additional or supplementary) Professional Data that we may request from you;
  • request marketing to be sent to you;
  • participate in a survey; or
  • provide us with feedback.

(E)        Third Parties or Publicly Available Sources.

We may receive personal data about you from various third parties and public sources, as set out below:

  • Technical Data from the following parties:
  • analytic providers such as Google Analytics;
  • advertising networks such as Facebook;
  • search information providers such as Google Ads.

Other sources may include:

  • the Medicines Authority, Malta Medical Council and other supervisory authorities or bodies;
  • public court documents;
  • anti-fraud databases and other third-party databases;
  • debt collection and credit reference agencies and fraud detection agencies;
  • publicly available sources, such as the electoral register.

6. HOW WE USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely upon to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data pursuant to more than one lawful ground or basis, depending on the specific purpose for which we are using your data.

Please contact us at info@script.mt if you need details about the specific legal grounds we are relying on to process your personal data where more than one ground has been set out in the table below.

 

 

Purpose/Activity

 

Type of Data

 

Lawful Basis for Processing (including Basis of Legitimate Interest)

 

 

Account Registration

 

To open and register your Partner Account with us (and send you confirmation of this, together with any account credentials).

 

 

(a) Identity;

 

(b) Contact;

 

(c) Professional;

 

(d) Financial.

 

 

 

 

(a) Performance of a contract with you

 

Account Maintenance and Relationship Management

 

(a) To enable us to manage our relationship with you in an efficient and effective manner;

 

(b) To keep our records up to date, including in relation to your account and use of the services;

 

(c) To perform material control and ensure that you have been provided with the best possible service from us;

 

(d) To respond to any queries or complaints we may receive from you and to seek to resolve these;

 

(e) To provide you with customer support and assistance;

 

(f) To manage disputes;

 

(g) To notify you of any changes to our terms or policies or the App.

 

 

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Professional;

 

(d) Financial;

 

(e) Service;

 

(f) Usage;

 

(g) Marketing.

 

 

 

 

 

(a) Performance of a contract with you;

 

(b) Necessary for our legitimate interests (including to provide the best service possible, for ‘customer care’, to study the use of the App and its services, to assess our operations and the quality of our service, to develop them and grow our business).

 

 

Service Provision

 

To provide the Services to you as a Partner, in particular:

 

(a) to transmit prescription and appointment requests made to you;

 

(b) to transmit your prescriptions to the end-user and create your scheduled appointments within the App (including reminders);

 

(c) to manage payments, including by collecting and releasing the fee due to you by the end-user;

 

(d) to collect and recover money as may be appropriate; and

 

(e) investigate any suspected fraudulent transactions.

 

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Professional;

 

(d) Financial;

 

(e) Service;

 

(f) Usage.

 

 

 

 

 

(a) Performance of a contract with you

 

(b) Necessary for our legitimate interest, including to collect and recover debts and prevent fraudulent transactions.

 

Legal Requirements

 

For legal, tax and accounting purposes (e.g. reporting to tax authorities, and accounting record requirements).

 

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Financial;

 

(d) Service;

 

(d) Marketing.

 

 

 

 

 

 

 

 

(a) Necessary to comply with a legal obligation;

 

(b) Necessary for our legitimate interests (fraud detection / prevention / reporting).

 

Operational Needs

 

To administer and protect our business carried out through the App – “Script” (including data analysis, system maintenance, support, safety and security testing, troubleshooting, reporting and hosting of data).

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Usage;

 

(d) Technical.

 

 

Necessary for our legitimate interests (for running and administering our business and organisation, network security).

 

 

Marketing

 

(a)To deliver marketing to you and measure or understand the effectiveness of the marketing which we serve to you;

 

(b) To develop and carry out marketing activities;

 

(c) For statistical research and analysis so that we can monitor and improve our products and services, or develop new ones.

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Professional;

 

(d) Service;

 

(e) Usage;

 

(f) Marketing;

 

(g) Technical.

 

 

 

Necessary for our legitimate interests (to to develop our list of registered partners and procure new partners, to grow our business and to inform our marketing strategy).

 

Legal Claims and Enforcement

To permit Script to exercise its rights or pursue any remedies available to it (including debt recovery) and to limit any losses which we may sustain.

 

 

 

(a) Identity;

 

(b) Contact;

 

(c) Professional;

 

(d) Financial;

 

(e) Service;

 

(f) Usage;

 

(g) Marketing.

 

 

Necessary to establish, exercise or defend legal claims.

 

Marketing

You may receive marketing communications from us (which may consist of newsletters, industry updates, mailshots, publications, promotional materials and/or information about our events) where:

  • you have an ongoing relationship with us (e.g., a registered partner); OR
  • (in the absence of a relationship), you consent to receiving such marketing communications;

AND

  • provided you have not unsubscribed to receiving marketing from us (see your right to object below).

THIRD-PARTY MARKETING

We will get your express opt-in consent before we share your personal data with any third parties (including any associated or affiliated entities) for marketing purposes.

Opting Out

You can ask us to stop sending such advertising and marketing communications at any time by:

  • following the opt-out links on any marketing message sent to you;
  • contacting us at any time at info@script.mt.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, or we are obliged to process your data by applicable laws or court or other enforceable orders.

If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at info@script.mt.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

7. DISCLOSURES OF YOUR PERSONAL DATA

We may need to share your personal data with third parties for the purpose set out above.

Information we may share to other parties:

Information we may share to other parties:

  • external third-party consultants, (sub-)contractors, suppliers or other service providers who may access your data when providing services to us (including but not limited to IT support services). This includes information technology experts who design and host the App, and general service companies. These are carefully selected to ensure that they meet high data protection and security standards. We only share data with them that is required for the services offered and we contractually bind them to keep any information we share with them as confidential and to process personal data only according to our instructions;
  • auditors or other advisors auditing, assisting with or advising on any of our business purposes;
  • our successors in title or third parties to whom we may choose to sell, transfer, or merge parts of our business or assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, the new owners may use your data in the same way as set out in this Notice; or
  • government bodies and law enforcement agencies and in response to other legal and regulatory requests or by instruction from a court, tribunal or public authority.

Where your details are provided to any other party in accordance with an express purpose, we will require them to be kept safe and secure your personal data and only use it for the intended purpose.

Furthermore, we may also disclose your data to enforce our contractual terms against you, or to protect our rights, property or safety, and that of other users of the App. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

8. INTERNATIONAL TRANSFERS

We do not generally transfer your personal data to entities outside the EEA except as may be necessary to: (i) enable your use of the App or  to provide the Services, (ii) fulfil our contractual obligations to you or exercise our contractual obligations against you, (iii) comply with our legal or regulatory obligations or (iv) assert, file or exercise a legal claim. Where we do need to transfer your personal data outside the EEA (whether for these stated purposes or any other purpose listed in Section 6above), we will ensure a similar degree of protection is afforded to that personal data by ensuring at least one of the following safeguards applies or is otherwise implemented:

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
  • In the absence of an adequacy decision, we will use standard contractual clauses that have been approved by the European Commission.

Please contact us at info@script.mt if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

9. DATA SECURITY

The Internet is not a secure medium. Please also be aware that communications over the Internet, such as emails/webmails, are not secure unless they have been encrypted. Your communications may route through a number of countries before being delivered. This is the nature of the World Wide Web/Internet. We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.

However, we have put in place a range of security procedures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also regularly review and, where practicable, improve upon these security measures. We limit access to your personal data to personnel who ‘need-to-know’ such information, as based on their respective work duties with us.

Additionally, we have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10. DATA RETENTION

How long will you use my personal data for?

Please note that we consider our relationship with you to be an ongoing relationship, until terminated

Unless a different timeframe has been specifically stated in this Policy, personal data will be retained for as long as is necessary for the purpose(s) for which we originally collected it or to resolve disputes, establish legal defense, conduct audits, pursue legitimate business purposes, and enforce our contractual terms.

We may also retain information as required by applicable law.

Outside of exceptional cases, we normally apply the following retention periods:

  • 10 years for payment and transaction information (for accounting and tax records); and
  • 5 years following termination or other closure of your account for all other data.

There may also be other instance where we may need to retain your personal data for longer period(s), such as in relation to threatened or commenced claims, disputes, or litigation, ongoing or pending investigations, requests made by competent authorities or for audits or investigations carried out by them.

You will always retain access to your patient records and have the right for them ported to you.

Kindly contact us for further details about the retention periods that we apply.

11. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

  • Request access to your personal data.
  • Request correction (rectification) of your personal data.
  • Request erasure of your personal data.
  • Object to processing of your personal data.
  • Request restriction of processing your personal data.
  • Request transfer of your personal data.
  • Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us at info@script.mt.

No fee usually required

You will not normally have to pay a fee to exercise your data subject rights.

However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Alternatively, we may refuse to comply with your request in the above circumstances.

 What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other data subject rights).  This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up or facilitate our response.

Time limit to respond

We try to respond to all legitimate requests within the period of one month from receipt of the request.

Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

These rights are explained below.

  • Access: You have the right to obtain confirmation that your information is being processed and to obtain access to your information, g., by receiving a copy of it.
  • Rectification: You have the right to have your information corrected if it is inaccurate or incomplete
  • Erasure: You have the right to request the deletion or removal of your information in certain circumstances.  Please note that there may be circumstances where it is not possible to fulfil the request for your information to be deleted, gif there is a legal reason to retain it.
  • Object: You have the right to object to processing of your personal data where we are relying on a legitimate interest or those of a third party, and you want to object as you feel it impacts on your fundamental rights or freedoms.  You also have the right to object where we are processing your data for marketing purposes.
  • Restrict: You have the right to request that the processing of your information is restricted in certain circumstances.  Again, there may be cases where we are legally entitled to refuse such a request.
  • Data Portability: You have the right to request the transfer of your personal data to you or to a third party. We will provide that personal data in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Your patient records are covered by this right.
  • Withdrawal: You may withdraw your consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdrew your consent and any processing activities that are not based on your consent will remain unaffected. Once we have been made aware that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. In the case of health data, it would no longer be possible for us to provide the requested Services to you.

Kindly note that none of these data subject rights are absolute and must generally be weighed against our own legal obligations and legitimate interests. If a decision is taken to override your data subject request, you will be informed of this by our data protection team along with the reasons for our decision. 

12. CHANGES TO THIS NOTICE

This Notice may be updated from time to time.

Please note that if our business, or any part of it, is sold or transferred at any time, the information we hold may form part of the assets transferred, although it will still only be used in accordance with this Notice.

You have the right to lodge a complaint at any time to a competent supervisory authority on data protection matters, such as in particular the supervisory authority in the place of your habitual residence or your place of work. In the case of Malta, this is the Office of the Information and Data Protection Commissioner (https://idpc.org.mt). We would, however, appreciate the opportunity to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance. Please use the words ‘Data Protection Matter’ in the subject line.

We reserve the right, at our discretion, to change, modify, add, or remove portions from this Notice at any time.  Please read this Notice carefully and re-visit this page from time to time to review for changes.